DNS Resolution Revisited

[balcv]

I previously asked for some help on setting up dns resolution when performing searches and I got some great info and was able to get it all working. BUT, after a recent change in my Splunk install (the version I was using expired), the dns resolution will not work.

I have the required lines on my transforms.conf:
[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

Then in my search I have (where dst is the ip address I want resolved):
source="udp:64514" SSH_Connects | lookup dnsLookup dst

Rather than get the data I require with the dst resolved I get this error:
Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

Can anyone enlighten me on what I'm doing wrong.

[usethedata]

My guess is that your script is not outputting the fields that are expected. Don't you need to do lookup dnsLookup ip as dst to get the ip address passed in with the right name?

[balcv]

Thank you. That was what I needed. Search that now works is and gives resolved name, ip and count:
source="udp:64514" SSH_Connects | stats count by dst | lookup dnsLookup ip as dst | sort -count | table host dst count